29288 matches found
CVE-2026-49394
creationtimestamp| type| source ---|---|--- 2026-07-11 02:54:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdnxgp6ki2c...
MINI-77VF-47WV-8C8G
Bulletin has no description...
MINI-52V4-QC9M-H4X3
Bulletin has no description...
MINI-5J6F-MH3H-F2GM
Bulletin has no description...
MINI-R552-H7WG-QC3Q
Bulletin has no description...
MINI-M83P-62FH-MJ9G
Bulletin has no description...
MINI-87RC-V2PX-GQX2
Bulletin has no description...
PT-2026-57406
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm product archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-10041: Authorization Bypass Through User-Controlled Key
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfmproductarchive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-13116: Authorization Bypass Through User-Controlled Key
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generatedocumentshortcode due to missing validation on a user controlled key. This makes it possible for authenticated...
PT-2026-57388
Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.14.1 Description An Insecure Direct Object Reference IDOR exists in the generate document shortcode function due to missing validation on a user-controlled key. Authenticated...
CVE-2026-13232
The Drupal Advanced Content Feedback (aka admin_feedback ) module, versions 0.0.0 through 2.8.0 , is vulnerable to an Incorrect Authorization issue allowing Forceful Browsing . The root cause is that the module fails to sufficiently verify authorization over a targeted feedback record when proces...
CVE-2026-13232 Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback aka adminfeedback allows Forceful Browsing. This issue affects Advanced Content Feedback aka adminfeedback versions: from 0.0.0 to 2.8.0...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
MINI-VJR5-CFV7-2F73
Bulletin has no description...
MINI-VCRV-V854-5MJ3
Bulletin has no description...
MINI-QPP8-CRPR-HJ9F
Bulletin has no description...